Search
Find a vulnerability
Search criteria
4 vulnerabilities by gumlet
CVE-2026-109398 (GCVE-0-2026-109398)
Vulnerability from nvd – Published: 2026-10-12 15:16 – Updated: 2026-10-13 18:20
VLAI
EPSS
VEX
Title
Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
Summary
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:20 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/gumlet/php-image-resize/securi… | vendor-advisory |
| https://github.com/gumlet/php-image-resize/commit… | patch |
| https://github.com/gumlet/php-image-resize/commit… | patch |
| https://github.com/gumlet/php-image-resize/blob/3… | technical-description |
| https://github.com/gumlet/php-image-resize/releas… | release-notes |
| https://www.vulncheck.com/advisories/gumlet-php-i… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gumlet | php-image-resize |
Affected:
0 , < 3.0.1
(semver)
|
Date Public
2026-10-06 18:18
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109398",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:20:05.846510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:20:30.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/gumlet/php-image-resize",
"product": "php-image-resize",
"repo": "https://github.com/gumlet/php-image-resize",
"vendor": "gumlet",
"versions": [
{
"lessThan": "3.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ikram-4"
}
],
"datePublic": "2026-10-06T18:18:16.000Z",
"descriptions": [
{
"lang": "en",
"value": "Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T15:16:43.793Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3g9v-hjrx-mg5h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gumlet/php-image-resize/commit/10c1f386e672536d82be0f39b236a80d87767a50"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gumlet/php-image-resize/commit/cd01c9e8aa2382211d760c825799c8102987a8c2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gumlet/php-image-resize/blob/3.0.0/lib/ImageResize.php#L122-L163"
},
{
"name": "php-image-resize 3.0.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/gumlet/php-image-resize/releases/tag/3.0.1"
},
{
"name": "VulnCheck Advisory: Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gumlet-php-image-resize-before-3.0.1-denial-of-service-via-decompression-bombs"
}
],
"title": "Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109398",
"datePublished": "2026-10-12T15:16:43.793Z",
"dateReserved": "2026-10-12T14:40:48.402Z",
"dateUpdated": "2026-10-13T18:20:30.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-13576 (GCVE-0-2024-13576)
Vulnerability from nvd – Published: 2025-02-18 04:21 – Updated: 2026-04-08 16:59
VLAI
EPSS
VEX
Title
Gumlet Video <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Summary
The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-18 15:00 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| adityapatadia | Gumlet Video |
Affected:
0 , ≤ 1.0.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13576",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-18T15:00:36.556871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T15:01:09.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gumlet Video",
"vendor": "adityapatadia",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Thaleikis"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s \u0027gumlet\u0027 shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:59:01.455Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8b94fc-9ae7-47f3-b804-92d0948b662e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gumlet-video/tags/1.0.3/gumlet-video.php#L112"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3241647/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-17T15:47:38.000Z",
"value": "Disclosed"
}
],
"title": "Gumlet Video \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13576",
"datePublished": "2025-02-18T04:21:16.825Z",
"dateReserved": "2025-01-21T14:19:49.566Z",
"dateUpdated": "2026-04-08T16:59:01.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109398 (GCVE-0-2026-109398)
Vulnerability from cvelistv5 – Published: 2026-10-12 15:16 – Updated: 2026-10-13 18:20
VLAI
EPSS
VEX
Title
Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
Summary
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:20 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/gumlet/php-image-resize/securi… | vendor-advisory |
| https://github.com/gumlet/php-image-resize/commit… | patch |
| https://github.com/gumlet/php-image-resize/commit… | patch |
| https://github.com/gumlet/php-image-resize/blob/3… | technical-description |
| https://github.com/gumlet/php-image-resize/releas… | release-notes |
| https://www.vulncheck.com/advisories/gumlet-php-i… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gumlet | php-image-resize |
Affected:
0 , < 3.0.1
(semver)
|
Date Public
2026-10-06 18:18
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109398",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:20:05.846510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:20:30.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/gumlet/php-image-resize",
"product": "php-image-resize",
"repo": "https://github.com/gumlet/php-image-resize",
"vendor": "gumlet",
"versions": [
{
"lessThan": "3.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ikram-4"
}
],
"datePublic": "2026-10-06T18:18:16.000Z",
"descriptions": [
{
"lang": "en",
"value": "Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T15:16:43.793Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3g9v-hjrx-mg5h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gumlet/php-image-resize/commit/10c1f386e672536d82be0f39b236a80d87767a50"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gumlet/php-image-resize/commit/cd01c9e8aa2382211d760c825799c8102987a8c2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gumlet/php-image-resize/blob/3.0.0/lib/ImageResize.php#L122-L163"
},
{
"name": "php-image-resize 3.0.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/gumlet/php-image-resize/releases/tag/3.0.1"
},
{
"name": "VulnCheck Advisory: Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gumlet-php-image-resize-before-3.0.1-denial-of-service-via-decompression-bombs"
}
],
"title": "Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109398",
"datePublished": "2026-10-12T15:16:43.793Z",
"dateReserved": "2026-10-12T14:40:48.402Z",
"dateUpdated": "2026-10-13T18:20:30.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-13576 (GCVE-0-2024-13576)
Vulnerability from cvelistv5 – Published: 2025-02-18 04:21 – Updated: 2026-04-08 16:59
VLAI
EPSS
VEX
Title
Gumlet Video <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Summary
The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-18 15:00 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| adityapatadia | Gumlet Video |
Affected:
0 , ≤ 1.0.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13576",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-18T15:00:36.556871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T15:01:09.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gumlet Video",
"vendor": "adityapatadia",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Thaleikis"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s \u0027gumlet\u0027 shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:59:01.455Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8b94fc-9ae7-47f3-b804-92d0948b662e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/gumlet-video/tags/1.0.3/gumlet-video.php#L112"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3241647/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-17T15:47:38.000Z",
"value": "Disclosed"
}
],
"title": "Gumlet Video \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13576",
"datePublished": "2025-02-18T04:21:16.825Z",
"dateReserved": "2025-01-21T14:19:49.566Z",
"dateUpdated": "2026-04-08T16:59:01.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}